Home›Productivity›Microsoft 365›Governance Reference Architecture

XcellHost|Microsoft 365 Governance

Reference Architecture

Most tenants already own the controls. Few can say who answers for each one.

Five layers — identity, information, workloads, monitoring and recovery — mapped to the Microsoft licences you hold, with a named owner for every layer. XcellHost designs it, runs it and shows you the gaps in rupees.

Entra ID, PIM & Agent ID
Purview labels, DLP, retention
Exchange, SharePoint, Teams
Defender XDR & Sentinel
Backup & tested restores
A named owner per layer
tenant-in · governance stack Sample data
01Identity & Access · every sign-in checked
Designed & run by Microsoft Gold Partner XcellHost · 24×7 NOC + SOC, Mumbai
Since 1999 · MumbaiMicrosoft Gold PartnerISO 27001 · ISO 20000-124×7 NOC + SOCTier IV Mumbai data centreMeitY empanelled
Who uses the tenant

Four kinds of user. One set of rules for all of them.

Governance starts with who is inside your Microsoft 365 tenant. Each group needs different access, and each one is someone's responsibility.

Staff

Collaborate, share files and use Copilot every day.

  • MFA and Conditional Access on every sign-in
  • Labels decide what can leave
Layers 1 · 2 · 3

Guests & partners

Join Teams and SharePoint sites from outside your organisation.

  • Guest access that expires
  • A site owner who vouches for them
Layers 1 · 2

AI agents

Act with delegated rights or with their own identity.

  • An Entra agent identity, not a shared secret
  • A human sponsor who answers for it
Layers 1 · 3 · 4

Administrators

Configure, monitor and respond — the highest-value accounts.

  • Admin rights activated for hours, not forever
  • Two emergency accounts, alerted on use
Layers 1 · 4 · 5
Reference architecture

Pick your licence. See what's included, what's an add-on, and what only needs an owner.

Every block below is checked against Microsoft Learn (November 2026). Tap any capability for the detail, the licence it needs and the XcellHost service that runs it.

IncludedPartly includedAdd-on or separateNo licence — needs an owner

Microsoft 365 E3: Entra ID P1, Intune Plan 1, manual labels and core DLP, Audit (Standard). E3 page →

1
Identity & AccessWho can get in, and how
Microsoft Entra ID
2
Information ProtectionWhat people can see and share
Microsoft Purview
3
WorkloadsWhere the work happens
Microsoft 365 apps
4
Monitoring & ResponseHow you know, and who acts
Defender & Sentinel
5
Resilience & RecoveryThe base layer
Microsoft 365 Backup
Layer 1 · Identity & Access

Privileged Identity Management

Licence prices are Microsoft licences per user per month excl. 18% GST, as listed on the linked XcellHost pages: Business Premium ₹1,830 (Microsoft Defender page), E3 ₹3,000 (E3 page), E5 ₹4,920 (E5 page), E7 ₹8,699* (E7 page, indicative). Capabilities vary by licence and Microsoft changes packaging; we confirm your exact SKUs before you buy. See the Microsoft 365 licensing guide.

The five layers

What good looks like, layer by layer.

Read it bottom-up for risk and top-down for users. Each layer has a job, an owner and evidence you can show an auditor.

Who can get in, and how

Identity & Access

Every person, guest, device and agent signs in through Microsoft Entra ID. Conditional Access decides what each sign-in can reach. Admin rights are eligible, not permanent, and switch on for a few hours with approval in Privileged Identity Management.

  • Phishing-resistant MFA for admins; MFA for everyone
  • Only compliant, Intune-managed devices reach sensitive apps
  • Two cloud-only emergency accounts with passkeys, excluded from blocking policies and tested at least every 90 days
  • Agents get an Entra agent identity and a human sponsor
OwnerIdentity leadUsually the IT head or a security architect
EvidenceCA policy export · PIM activation log · break-glass test record
XcellHost runs itManaged Identity · Entra ID · PIM · Intune
What people can see and share

Information Protection

Microsoft Purview sensitivity labels classify mail and files; DLP stops personal and financial data leaving by email, chat or link; retention keeps what the law asks and deletes the rest. Before Copilot reads your sites, oversharing reports find content open to everyone.

  • A short label set people actually use (four to five labels)
  • DLP moved from audit to enforce, with policy tips
  • Retention schedule mapped to Indian record-keeping rules
  • External sharing defaults narrowed; guest links expire
OwnerData owner / DPOWorks with business heads who own the content
EvidenceLabel usage report · DLP incident log · retention policy list
XcellHost runs itDPDP platform · Email encryption · vDPO
Where the work happens

Workloads

Exchange Online, SharePoint, OneDrive, Teams, Power Platform and Microsoft 365 Copilot are where data is created and shared. Governance here is lifecycle: who may create a Team or site, who owns it, when it is archived and which connectors and agents may touch it.

  • At least two owners for every Team and site
  • Inactive sites flagged, attested or archived
  • Power Platform DLP policies by environment
  • Copilot switched on after permissions are cleaned up
OwnerWorkload ownersMessaging, collaboration and automation leads
EvidenceOwnerless-site report · agent inventory · connector policy
XcellHost runs itManaged Microsoft 365 · Agent 365 · Power Automate
How you know, and who acts

Monitoring & Response

Defender XDR joins alerts into incidents, Purview Audit records who did what (180 days in Audit Standard; one year for core workloads in Audit Premium), Secure Score tracks configuration and Microsoft Sentinel keeps the long record. None of it helps unless an alert reaches a named person with a time limit.

  • Every alert type routed to a named responder
  • Audit retention set to your policy, not the default
  • Secure Score actions assigned and reviewed monthly
  • CERT-In reporting step inside six hours
OwnerSOC leadInternal team or a managed SOC
EvidenceIncident timeline · MTTR trend · audit retention policy
XcellHost runs itDefender · Managed Sentinel · MXDR · Posture
The base layer

Resilience & Recovery

Retention isn't backup. Microsoft 365 Backup or a third-party backup gives restore points outside day-to-day deletion; a backup only counts once a restore has been tested and timed. The incident response plan and emergency access procedure are written, reachable offline and drilled.

  • Exchange, SharePoint and OneDrive backed up; Entra ID configuration too
  • Restore test every six months with the time recorded
  • Incident response plan with names and phone numbers
  • Break-glass procedure printed and stored securely
OwnerRecovery ownerOften the infrastructure or BCP lead
EvidenceRestore test report · IR plan version · drill minutes
XcellHost runs itEntra ID Backup · M365 backup · Incident response
Ownership & accountability

A control without an owner is a setting waiting to drift.

The tools come with the licence. Names don't. These seven habits turn configuration into governance.

Named owner per layer

One person per layer, written down, with a deputy. Not "IT".

Site & team owners

Two owners for every Team and site, who confirm membership each quarter.

Agent sponsors

Entra lets you set a human sponsor on each agent identity; sponsorship passes to their manager when they leave.

Exception register

Every policy exclusion has a reason, an approver and an expiry date.

Access reviews

Guests, groups and admin roles re-approved on a schedule (Entra ID P2 or Governance).

Alert response owners

Each alert type maps to a responder and a response time.

Risk acceptance by name

When a gap stays open, a named executive signs for it — with a review date.

Most tenants already own the controls.Few can say who answers for each one.
Governance maturity check

Score each layer in five minutes. Leave with a gap list and a RACI.

Answer honestly — Yes, Partly or No. Add the owner's name for each layer and download a RACI template you can fill in with your team. Nothing leaves your browser.

Layer 1

Identity & Access

    0 of 29 answered
    0%Not started

    Your gap list

    Answer a few questions and your gaps appear here, worst first, with the XcellHost service that closes each one.

      Licence-coverage checker

      Enter your licence mix. See which controls cover everyone — and the cost to close each gap.

      Most Indian tenants mix plans. Coverage is worked out per user, because a Conditional Access or Audit Premium feature only protects the people who are licensed for it.

      Coverage of key controls · 190 users
      0%
      weighted average across 10 controls
      Cost to close priced gaps / month₹0
      + 18% GST₹0
      Sentinel free ingestion (E5/E7 grant)0 GB/day

      Microsoft licence prices as listed on XcellHost pages, excl. GST: Entra ID P2 ₹755 (Entra ID), Copilot ₹2,649 and Agent 365 ₹1,319 (E7 page, indicative), Entra ID Backup ₹125, third-party M365 backup ₹149* (Acronis* page). Microsoft 365 Backup is billed by Microsoft at US$0.15 per GB per month. Items without a listed price (for example Audit Premium add-ons) are shown as "quote".

      XcellHost services by layer

      Every layer has a service and a price you can check.

      Prices below are the indicative INR prices published on each linked XcellHost page, excl. 18% GST.

      1Identity & Access
      2Information Protection
      3Workloads
      4Monitoring & Response
      5Resilience & Recovery
      Plans

      Governance run as a service. One tenant, one monthly fee.

      Each plan keeps the owner register, exception register, review calendar and restore tests running. Onboarding starts with the Microsoft 365 Security Assessment (₹49,999, as on that page). Microsoft licences are billed separately.

      Governance Essentials

      Business Premium tenants

      ₹14,999*/ tenant / month

      Up to 300 users · extra 100 users ₹1,999*

      • Owner & exception registers kept current
      • Quarterly guest and admin reviews
      • Restore test twice a year
      • Quarterly governance report
      Most chosen Governance Professional

      E3 & mixed-licence tenants

      ₹34,999*/ tenant / month

      Up to 1,000 users · extra 100 users ₹1,999*

      • Conditional Access & label change control
      • Monthly oversharing & ownerless-site clean-up
      • Alert routing map maintained
      • Quarterly restore and break-glass drills
      • Monthly governance report
      Governance Enterprise

      E5 / E7, Copilot & agents

      ₹69,999*/ tenant / month

      Up to 5,000 users · extra 100 users ₹1,999*

      • Agent inventory with sponsors and expiry
      • Copilot readiness gates per site
      • Audit Premium retention & investigation support
      • Quarterly board-level review
      • Named governance lead

      * Indicative — confirm with XcellHost. INR per tenant per month, excluding 18% GST. Governance plan prices and the extra-users price are placeholders; the services in the builder below reuse the exact prices on their linked pages.

      Configure

      Build your governance stack. See the first invoice.

      Pick a plan, set users and devices, and add the layer services you need. Your first invoice is one month of service plus one-time items.

      Your estimate · indicative

      Governance Professional

      Monthly₹0
      One-time₹0
      Subtotal (first invoice)₹0
      GST 18%₹0
      ₹0
      first invoice incl. GST · then ₹0/month incl. GST

      * placeholder, indicative — confirm with XcellHost. Other prices as on the linked XcellHost pages. Excl. Microsoft licences and Azure consumption.

      Frequently Asked Questions

      A map of the controls that keep a Microsoft 365 tenant safe and usable, grouped into five layers — identity and access, information protection, workloads, monitoring and response, and resilience — with a named owner for each layer and a set of habits (reviews, exception register, risk acceptance) that keep the settings from drifting.

      Yes. A Microsoft 365 Security Assessment checks settings at one point in time. Governance decides who owns each control, how changes are approved, when access is re-reviewed and how recovery is proven. We usually start with the assessment and use it as the baseline.

      Business Premium and E3 include Entra ID P1 (Conditional Access), Intune Plan 1, manual sensitivity labels and core DLP. E5 adds Entra ID P2 (PIM, risk-based access), automatic labelling, Audit Premium and full Defender XDR. E7 adds Microsoft 365 Copilot, the Entra Suite and Agent 365 on top of E5. Use the licence filter and the coverage checker above, then talk to us before you upgrade everyone.

      No. PIM needs Entra ID P2 or Entra ID Governance for the people who use it — eligible admins, approvers and reviewers — not for every user. Adding P2 at ₹755 per user per month for a handful of admins is often far cheaper than moving the whole tenant to E5.

      Microsoft's identity framework for AI agents. Microsoft Learn says agent identities are available to all Entra customers; extending Entra security to agents — Conditional Access for agents and entitlement management for agent identities and sponsors — needs Microsoft Agent 365, which is included in Microsoft 365 E7 and sold as an add-on. Each agent can have a human sponsor, and sponsorship moves to the sponsor's manager if they leave.

      Per Microsoft Learn, if at least one Copilot licence is assigned in the tenant, SharePoint admins get most SharePoint Advanced Management features — oversharing reports, restricted content discovery, site access reviews, inactive-site and ownership policies. A few items still need the SAM Plan 1 add-on or E5. E7 includes Copilot, so it includes these features.

      Retention keeps content from being permanently deleted; it is not a separate restore point you can roll a whole site or mailbox back to after ransomware, a bad script or a malicious admin. Microsoft 365 Backup (billed by Microsoft at US$0.15 per GB per month of protected content) or a third-party backup gives you that. Either way, a restore test is what proves it.

      Audit (Standard) keeps records for 180 days. Audit (Premium) keeps Exchange, SharePoint, OneDrive and Entra ID records for one year by default, and a 10-Year Audit Log Retention add-on extends it for licensed users. For longer or cross-platform retention we forward logs to Microsoft Sentinel; E5 and E7 customers get up to 5 MB per user per day of qualifying Microsoft 365 data ingested at no charge.

      The DPDP Act expects reasonable security safeguards and prompt breach handling; CERT-In expects cyber incidents to be reported within six hours. Layers 2, 4 and 5 give you the evidence: what personal data is labelled and protected, who accessed it, how fast an incident was noticed and that you can restore. Our DPDP compliance platform and vDPO cover the privacy side.

      No. Many customers keep identity in-house and hand us monitoring and recovery, or the reverse. The governance plan keeps the owner register for all five layers, including the ones you run yourself.

      Service prices reused from other XcellHost pages are shown as on those pages. Governance plan fees marked * are placeholders, indicative only — we confirm them in a written INR quotation with 18% GST. Microsoft licences are billed separately at the prices on the linked licence pages.